Can an administrator change the password of the users?

[cesar-sanjuan]

What version of GlobaLeaks are you using?

5.0

What browser(s) are you seeing the problem on?

Chrome

What operating system(s) are you seeing the problem on?

Windows

Describe the issue

Sorry in advance for putting this question in the bug section, but I've put it in two other forums a few days ago and I haven't had any response and the truth is that we're in a hurry...
We have a user who cannot enter the application. It fails to identify itself.
From the user administration management we have generated the link to change the password. But when you run it, it asks for the security key and tells us that it doesn't have it.
This is the user who manages the complaints, so it is necessary for them to have access.
As administrators, how can we change the password so that they can access it?
Thank you

Proposed solution

No response

[evilaliv3]

Hello @cesar-sanjuan , thank you for your message, i will answer here but please use only discussions ofr this requests.

We try to do our best to answer requests that are always handled with maximum priority.

To change the password or send a link that does not require to enter the account recovery key you need an administrator enabled to change users password.
Check the advanced settings to verify that you have enabled the escrow keys and which are currently the administrators that are enabled to change the passwords of the users.

reference: https://docs.globaleaks.org/en/stable/security/EncryptionProtocol.html#key-escrow

[cesar-sanjuan]

Good morning
Thanks for the quick response.
I had already seen the documentation that you sent us but it does not solve us.
I think we have some configuration error that I don't know how we can resolve.
In the advanced settings I see that the user who can change passwords is the ADMINISTRATOR user

But we have it disabled and we don't see how to activate it and we don't have its passwords
We have a user, with whom we have made all the configurations since going into production, who has the administrator label. But if this user accesses the settings of the user who cannot log in, it does not let him change the password

How can we do?
thank you!

[evilaliv3]

Dear @cesar-sanjuan
This is actually an unfortunate event, let me check with you the situation to confirm it first:

• if the password is not accepted means the password was changed but you may have not saved the new one
• if you do not have your account recovery key for your admin account recovery key, you are not able to recover your admin account and all the data protected by the account (the escrow keys for users paswords) are no longer accessible.

is this the case?

If this situation is confirmed unfortunately the system is very compromise because:

• you could not change password for your users so that if they forget their password and they do not have saved their account recovery key the access to their data is lost
• you might create new users but the the escrow mechanism is inaccessible and cannot be recovered so that administrators wont ever be in possibility to change users password

[cesar-sanjuan]

Yes, unfortunately this is the situation. We do not have the administrator's recovery key (if that of the other administrator user) and they do not find the recovery key of the processing user who has started to tell that his password is not correct when he tries to enter, and we cannot change the password to manage complaints.

[evilaliv3]

I'm sorry but there is no solution. Implementing encryption properly means that if password or alternative recovery keys or escrow keys are lost, access to data is permanently lost.

[cesar-sanjuan]

We have activated a processor type user that we had created from the beginning and with this user we managed to log in but it does not see any complaints. We tried to create a new test complaint and without doing any management of this complaint, this processing user does not see them. How can we make this processing user see the complaints created until today and also the new ones that are created?

[evilaliv3]

Complaints are delivered and encrypted for the users configured when the reports was loaded.

To enable the new user to access old reports:

• Enable recipients that have access to the report to give access to other users to the reports they have access to.
• Ask those recipients to grant access to the new user on the reports they have access to.